bolletjestrui: deploy main-10268f1 (routes, voting, push, ride uploads)

Adds the VAPID keypair for web push and raises the ingress body limit to 25m to
match the app's BODY_SIZE_LIMIT, since a bulk route import posts every GPX in one
request.

The VAPID env refs are optional:true on purpose — a missing key in a secretKeyRef
puts the pod in CreateContainerConfigError, and the app already handles absent
keys by sending no notifications.

bolletjestrui/external-secret.yaml

@@ -23,3 +23,14 @@ spec:
       remoteRef:
         key: kv/bolletjestrui
         property: key_secret
+    # web-push keypair for the "de route is gekozen" notification.
+    # Generate once with `npx web-push generate-vapid-keys` and never rotate it:
+    # a new key invalidates every subscription on everyone's phone.
+    - secretKey: vapid_public_key
+      remoteRef:
+        key: kv/bolletjestrui
+        property: vapid_public_key
+    - secretKey: vapid_private_key
+      remoteRef:
+        key: kv/bolletjestrui
+        property: vapid_private_key